2.22 Describe Tools and Their Limitations for Network Analysis Such as Packet Capture Tools, Traffic Analysis Tools, Network Log Analysis Tools 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A network analyst is investigating a possible DNS tunneling attack. The analyst has access to NetFlow data, DNS server logs, and the ability to capture packets on the DNS server. The NetFlow data shows a large volume of DNS traffic to a single external server. The DNS logs show many queries with long subdomains. The analyst wants to confirm the tunneling and determine the data being exfiltrated. Which approach is most effective?

   • ACapture packets on the DNS server and decode the DNS queries to extract the exfiltrated data.
   • BUse the NetFlow data to estimate the volume of data exfiltrated.
   • CAnalyze the DNS logs to identify the pattern of long subdomains and infer the data.
   • DBlock the external server's IP address to stop the exfiltration.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is correlating firewall logs with authentication logs to investigate a breach. The firewall logs show a connection from an internal IP to an external IP at 10:15:30, but the authentication logs show the user logged in at 10:16:45. The analyst suspects the user's account was compromised. What limitation of network log analysis tools is most likely affecting the investigation?

   • AIncomplete logging, because the firewall did not log the full session.
   • BLack of deep packet inspection, because the logs do not contain payload data.
   • CLog volume, because the firewall generates too many logs to analyze effectively.
   • DTime synchronization issues, because the firewall and authentication server may have different clock settings.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security analyst is investigating a possible command-and-control (C2) communication that used a low-and-slow pattern over several days. The analyst has NetFlow data with 1:1000 sampling and full packet capture only for the last hour. Which approach is most likely to reveal the C2 communication?

   • AAnalyze the NetFlow data for any flows to known C2 IPs, even if the byte counts are low.
   • BRely on the firewall's syslog to identify the C2 traffic.
   • CUse the packet capture to reconstruct the full C2 session from the beginning.
   • DAnalyze the full packet capture from the last hour for any connection to known C2 IPs.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst is using NetFlow data to investigate a possible data exfiltration. The analyst notices that the total bytes reported by NetFlow are significantly lower than the bytes recorded by the firewall's own byte counter for the same session. What is the most likely reason for this discrepancy?

   • ANetFlow sampling reduced the number of packets counted, leading to an underestimation of traffic.
   • BThe firewall's byte counter is known to overcount due to double-counting retransmissions.
   • CThe firewall's byte counter includes only the packet headers, not the payload.
   • DNetFlow records only TCP traffic, not UDP traffic.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A network security team is planning to deploy a monitoring solution to detect malware infections on a high-speed (40 Gbps) backbone link. The team has the following options: full packet capture on a dedicated appliance, NetFlow export from the router, and a SIEM that collects firewall and IDS logs. The team's primary goal is to detect C2 traffic that uses encrypted protocols. Which solution is most effective for this goal?

   • ASIEM log collection from firewalls and IDS to correlate alerts.
   • BFull packet capture with TLS decryption using a proxy or man-in-the-middle appliance.
   • CA combination of NetFlow and SIEM logs, without packet capture.
   • DNetFlow export from the router to identify flows to known C2 IPs.
   Reveal Solution Discussion Select an answer first